Daily Digest
The most urgent threat is CVE-2026-85878 affecting Azure Database for PostgreSQL, which allows unauthenticated attackers to elevate privileges across the network, posing a critical risk to database administration and data integrity. This CISA KEV-confirmed entry demands immediate remediation to prevent unauthorized access and potential system compromise.
MySQL
PostgreSQL
Oracle Database
MongoDB
The most urgent item today is CVE-2026-61682 (CVSS 9.9 CRITICAL) in the kcp Kubernetes-like control plane, where the front-proxy fails to strip identity headers before forwarding to shards, enabling any authenticated tenant to impersonate system masters and bypass authorization across workspaces. While no CISA KEV-confirmed entries appear in this digest's dataset, this 9.9-score critical vulnerability represents the highest theoretical severity and is actively exploitable by any authenticated tenant in affected deployments. Secondary high-priority items include CVE-2026-75156 (CVSS 9.1, Azure AD OAuth token validation bypass in Apache Airflow FAB) and two Docker-related high-severity flaws in ToolHive and Pelican Panel.
Summary: Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Because signing keys are fetched from Microsoft's multi-tenant JWKS endpoint, an attacker who can register an Azure tenant can mint a valid `id_token` in their own tenant and authenticate to the Airflow UI with no prior access. The incomplete fix for CVE-2026-59243 only added signature verification, not issuer/audience checks, so operators who applied that fix are still affected.
Affected Features / Interoperability: Airflow's FAB auth manager when configured with Azure AD as an OAuth provider. Downstream impacts include unauthorized access to the Airflow UI, potential privilege escalation via role assignments read from the attacker-controlled token, and compromise of any workflow or DAG executed under the authenticated session. Client drivers and extensions relying on the FAB auth manager for Azure AD SSO would be affected.
Source:
Actions:
Summary: The Microsoft Container Migration Solution Accelerator (version 2.1.2 and earlier) contains an authenticated IDOR vulnerability where ownership checks are missing across multiple API endpoints. Authenticated users can read, write, and delete processes and files belonging to other users within the same organization. The application relies on Entra ID authentication but lacks proper authorization controls between users.
Affected Features / Interoperability: Process and file management APIs in the Container Migration Solution Accelerator. Downstream impacts include unauthorized access to migration data, potential disclosure of container service configurations being migrated to Azure Kubernetes Service, and cross-user data manipulation within the same organization.
Source:
Actions:
---
Summary: kcp is a Kubernetes-like control plane for form-factors beyond standard Kubernetes. Prior to versions 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters or other privileged identity headers, and the shard trusts these as authenticated assertions. This enables cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters.
Affected Features / Interoperability: kcp front-proxy and all shards relying on forwarded identity headers for authorization. Downstream impacts include complete cluster takeover by any authenticated tenant, cross-workspace resource access, RBAC bypass, and potential lateral movement across all workspaces managed by the kcp control plane. Integrations depending on kcp's multi-tenancy isolation (e.g., multi-tenant Kubernetes services, cross-workspace APIs) are fully compromised.
Source:
Actions:
Summary: CloudNativePG (prior to 1.28.4, 1.29.2, and 1.30.0) embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` SQL statements generated by SetUserPassword and appendPasswordOption. When pg_stat_statements is preloaded with track_utility enabled and an untrusted tenant holds pg_monitor or pg_read_all_stats, the tenant can recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute OS commands via `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected.
Affected Features / Interoperability: CloudNativePG's role password management and PostgreSQL superuser connection handling. Downstream impacts include full database superuser compromise, operating system command execution in the database pod, access to the pod ServiceAccount token, and potential cluster-wide lateral movement. PostgreSQL replication and client drivers connecting through superuser credentials would be compromised.
Source:
Actions:
Summary: Capsule (prior to 0.13.7) has a sorting bug in ForbiddenListSpec.ExactMatch where denied metadata keys are sorted case-insensitively but then searched using byte-order sorting via sort.SearchStrings. When an administrator's forbidden list mixes capitalized and lowercase keys, the binary search can return false for a present key, allowing an authenticated tenant owner to bypass configured namespace, Service, or delegated node metadata restrictions.
Affected Features / Interoperability: Capsule's forbidden metadata validation for multi-tenancy policy enforcement. Downstream impacts include tenants bypassing namespace restrictions, Service metadata policies, and delegated node metadata constraints, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary.
Source:
Actions:
Summary: Capsule (0.13.0 through 0.13.7) has a validation bug in Tenant update where ForbiddenLabels.Regex is compiled for both labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator can persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid, causing regexp.MustCompile to panic during forbidden metadata validation and deny namespace operations for the affected tenant.
Affected Features / Interoperability: Capsule's Tenant update webhook and namespace creation/update validation. Downstream impacts include denial of namespace operations for affected tenants due to regex panics, potentially disrupting CI/CD pipelines and application deployment workflows.
Source:
Actions:
Summary: Capsule (0.13.0 through 0.13.7) has a parameter-reversal bug in hostnameRegexHandler.OnUpdate where the new and old Tenant parameters are reversed, validating the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can store a malformed AllowedHostnames.Regex, causing subsequent Ingress creation or update to treat every hostname as unmatched and block Ingress operations for the affected tenant.
Affected Features / Interoperability: Capsule's Tenant webhook and Ingress hostname validation. Downstream impacts include blocked Ingress operations for affected tenants until an administrator repairs the Tenant configuration, potentially causing service outages for applications relying on hostname-based routing.
Source:
Actions:
Summary: Contour (versions 1.23.0 through 1.33.4) does not reject HTTPProxy configurations combining `.spec.virtualhost.tls.enableFallbackCertificate: true` with `.spec.virtualhost.jwtProviders`. Requests from clients that do not send TLS SNI or send an unrecognized SNI bypass JWT verification and are proxied to upstream services without a valid token. Fixed in Contour v1.33.5, which now rejects such configurations with a `TLSIncompatibleFeatures` status condition.
Affected Features / Interoperability: Contour's HTTPProxy TLS and JWT provider configuration. Downstream impacts include unauthenticated access to upstream services when fallback certificates are used, bypassing JWT-based authentication and potentially exposing protected APIs and workloads.
Source:
Actions:
Summary: The Sealed Secrets controller's unauthenticated POST endpoints (/v1/verify and /v1/rotate) are vulnerable to a decryption oracle attack. An attacker with internal network access can submit modified payloads with custom Go template logic in spec.template.data, exploiting missing AEAD label binding and template execution error side-channels (HTTP 200 vs 409) to recover the full plaintext of any sealed secret one character at a time.
Affected Features / Interoperability: Sealed Secrets controller's unauthenticated POST endpoints. Downstream impacts include full plaintext recovery of all sealed secrets, compromising Kubernetes secrets managed by Sealed Secrets and any applications or workloads depending on those secrets for configuration, credentials, or TLS certificates.
Source:
Actions:
Summary: Omni (prior to 1.6.6 and 1.7.3) passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host, enabling same-host endpoint probing and possible disclosure of internal diagnostics.
Affected Features / Interoperability: Omni's schematic creation and image factory client. Downstream impacts include internal endpoint probing, possible disclosure of internal diagnostics from the image-factory host, and potential information leakage about the infrastructure layout.
Source:
Actions:
Summary: CloudNativePG (prior to 1.28.4, 1.29.2, and 1.30.0) opens superuser connections without pinning search_path in fillDefaultParameters. A role holding DATABASE OWNER can create overloaded built-in operators in the public schema and change the database or role search_path, causing instance-manager introspection queries to execute attacker-controlled functions as the postgres superuser. The same trust issue affects direct sql.Open callsites and the public.user_search SECURITY DEFINER function, enabling PostgreSQL superuser access, OS command execution through `COPY ... FROM PROGRAM`, and access to the pod ServiceAccount token.
Affected Features / Interoperability: CloudNativePG's superuser connection management and search_path handling. Downstream impacts include full PostgreSQL superuser compromise, OS command execution in the database pod, access to the pod ServiceAccount token, and potential cluster-wide lateral movement. PostgreSQL replication and client drivers using superuser connections are affected.
Source:
Actions:
---
Summary: ToolHive (prior to CLI 0.30.1 and Studio 0.38.0) runs locally deployed MCP server containers with the default network permission profile without network isolation, permitting access to host.docker.internal. ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane. Studio additionally sends network_isolation as false and overrides the backend's secure isolation default.
Affected Features / Interoperability: ToolHive's MCP server container networking and API/proxy endpoints. Downstream impacts include data and log exposure, sibling MCP tool invocation, process or workload state alteration, and service disruption. For healthcare environments running ToolHive, this could expose patient data or compromise infrastructure management tools.
Source:
Actions:
Summary: Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.
Affected Features / Interoperability: Pelican Panel's server startup configuration and Livewire state handling. Downstream impacts include arbitrary command execution in containers, potential container escape, and full compromise of managed Docker hosts. For healthcare environments, this could expose patient data and critical infrastructure.
Source:
Actions:
Summary: The Python `sh`